A Copilot coding agent frequently opens draft pull requests that fail validation for different reasons: missing dependencies, test failures, and permission errors. You need to improve the workflow so maintainers can diagnose failures without allowing broken agent output to merge. Which four actions should you perform in order? 1. Upload diagnostics only after the pull request is merged. 2. Capture command output into a diagnostics directory. 3. Add conditional artifact upload for failed validation. 4. Convert failed validations into successful neutral checks. 5. Preserve the failed required-check result after diagnostics upload. 6. Add targeted permission checks for reporting steps.

The correct order is 2 → 3 → 6 → 5. 1. Capture command output into a diagnostics directory (2): This is the crucial first step to gather information about why the validation failed. Without this, you have no data to diagnose. 2. Add conditional artifact upload for failed validation (3): Once diagnostics are captured, you need to ensure they are uploaded only when validation fails. This prevents unnecessary uploads for successful runs and provides maintainers with the necessary context for failures. 3. Add targeted permission checks for reporting steps (6): Before attempting to upload diagnostics, ensure the agent has the necessary permissions. This prevents the diagnostic upload itself from failing due to permission errors, which would obscure the original validation failure. 4. Preserve the failed required-check result after diagnostics upload (5): It's essential that the pull request still shows a failed status even after diagnostics are uploaded. Converting failed validations into successful neutral checks (4) would hide the problem, allowing potentially broken code to merge. Uploading diagnostics only after merge (1) is too late for diagnosis.